Suricata

Currently specifying where a rule is hooked into the detection engine is not very easy to understand or control. The idea is to give the rule writer full control over this.

The 2nd field in the rule is the protocol. In some cases, a bit of a hook like control is provided here. Esp the "tcp-pkt" and "tcp-stream" provide this type of control.

In application layer protocols, there should be a minimum set of hooks, plus protocol specific sets.

• dns:request_complete -- tx is complete in the request direction
• dns:response_complete -- tx is complete is the response direction
• http:request_complete
• http:response_complete